2 ms·

I don't think this addresses my question, which whether there's anything that inherently makes "state actors" effective hackers than criminals or amateurs.

meowface 6y ago
Maybe I misunderstood your original post. I thought you were asking about the risks of regular people being able to gain NSA-like abilities if NSA tools manage to fall into their hands. I think that's not a huge risk, beyond zero-days. However, yes, a very dedicated, very smart group of blackhat hackers could probably achieve somewhat similar things as an intelligence agency's hacking division. You don't necessarily have to be a government to be an APT. There are still other advantages, though. For one, at NSA, you can do anything you want with legal impunity, while a blackhat might be imprisoned for doing the exact same thing. Also, you have access to a huge organization and various things they've already embedded themselves into, like backdoors and internet traffic taps. So, they do have an inherent advantage, even if the people involved aren't necessarily inherently better hackers. (Though they may be, if they're better at hiring than you are at recruiting for your private organization.) Given enough time and effort, a private group could maybe also embed themselves in a lot of places, but they're all at the mercy of their governments and allied governments, and may constantly risk arrest. In terms of this particular incident, I believe it absolutely could be either a government or a private whitehat/greyhat/blackhat individual or group.
TameAntelope 6y ago
The closest we got to an answer about who perpetrated these hacks was a quote in the article: > Only intelligence services or people who know where the servers are located can pull off things like that. I don't really know how the quotee would arrive at that conclusion, but I do agree the seemingly systemic nature of these hacks, e.g. "Let's hit the popular dark web forums." isn't usually how criminals operate, based on my limited understanding. That said, groups of people do seemingly weird things all the time, so I dunno if it's anything other than a gentle nudge in a direction. Hardly a smoking gun. Additionally, I've always heard the sophistication levels of hacking groups go (from least to most): activists -> criminals -> state groups. I don't know if that's changed in some recent years, but that's how I learned it.
- meowface 6y ago
  > "Let's hit the popular dark web forums." isn't usually how criminals operate, based on my limited understanding. Indeed. Most cybercrime, like most crime in general, is primarily interested in just making money as effectively, efficiently, and safely as possible. No point stirring up a bunch of big hornet's nests when you don't need to. Whatever it is, it's definitely not ordinary activity. Non-exhaustive list of some possibilities I'd imagine: - Blackhats who are part of that sphere with a chip on their shoulder - Blackhats trying to start, promote, or perhaps (false-flag style) direct suspicion towards a competing forum or other platform - Whitehats / greyhats who just don't like fraudsters and thieves and want to fuck with them and give them a taste of their own medicine - Intelligence agencies / law enforcement

meowface 6y ago

Maybe I misunderstood your original post. I thought you were asking about the risks of regular people being able to gain NSA-like abilities if NSA tools manage to fall into their hands. I think that's not a huge risk, beyond zero-days. However, yes, a very dedicated, very smart group of blackhat hackers could probably achieve somewhat similar things as an intelligence agency's hacking division. You don't necessarily have to be a government to be an APT. There are still other advantages, though. For one, at NSA, you can do anything you want with legal impunity, while a blackhat might be imprisoned for doing the exact same thing. Also, you have access to a huge organization and various things they've already embedded themselves into, like backdoors and internet traffic taps. So, they do have an inherent advantage, even if the people involved aren't necessarily inherently better hackers. (Though they may be, if they're better at hiring than you are at recruiting for your private organization.) Given enough time and effort, a private group could maybe also embed themselves in a lot of places, but they're all at the mercy of their governments and allied governments, and may constantly risk arrest. In terms of this particular incident, I believe it absolutely could be either a government or a private whitehat/greyhat/blackhat individual or group.

TameAntelope 6y ago

The closest we got to an answer about who perpetrated these hacks was a quote in the article: > Only intelligence services or people who know where the servers are located can pull off things like that. I don't really know how the quotee would arrive at that conclusion, but I do agree the seemingly systemic nature of these hacks, e.g. "Let's hit the popular dark web forums." isn't usually how criminals operate, based on my limited understanding. That said, groups of people do seemingly weird things all the time, so I dunno if it's anything other than a gentle nudge in a direction. Hardly a smoking gun. Additionally, I've always heard the sophistication levels of hacking groups go (from least to most): activists -> criminals -> state groups. I don't know if that's changed in some recent years, but that's how I learned it.

meowface 6y ago
> "Let's hit the popular dark web forums." isn't usually how criminals operate, based on my limited understanding. Indeed. Most cybercrime, like most crime in general, is primarily interested in just making money as effectively, efficiently, and safely as possible. No point stirring up a bunch of big hornet's nests when you don't need to. Whatever it is, it's definitely not ordinary activity. Non-exhaustive list of some possibilities I'd imagine: - Blackhats who are part of that sphere with a chip on their shoulder - Blackhats trying to start, promote, or perhaps (false-flag style) direct suspicion towards a competing forum or other platform - Whitehats / greyhats who just don't like fraudsters and thieves and want to fuck with them and give them a taste of their own medicine - Intelligence agencies / law enforcement